#!/bin/sh

LOG_FILE="/tmp/firewall_custom.log"

# Create script directory in /data
mkdir -p /data/custom_firewall

# Prompt for port configurations
echo "Enter TCP ports (multiple ports separated by space, e.g., 443 8080, press Enter to skip):"
echo "输入TCP端口号(多个端口号用空格分开，如：443 8080，回车跳过):"
read TCP_PORTS_INPUT

echo "Enter UDP ports (multiple ports separated by space, e.g., 443 8080, press Enter to skip)"
echo "输入UDP端口号(多个端口号用空格分开，如：443 8080，回车跳过):"
read UDP_PORTS_INPUT

echo "Enter TCP port ranges (e.g., 1000:1010 for ports 1000-1010, multiple ranges separated by space, press Enter to skip):"
echo "输入TCP端口号段(如：1000:1010 指 1000-1010，多个号段间用空格分开，回车跳过):"
read TCP_RANGES_INPUT

echo "Enter UDP port ranges (e.g., 1000:1010 for ports 1000-1010, multiple ranges separated by space, press Enter to skip):"
echo "输入UDP端口号段(如：1000:1010 指 1000-1010，多个号段间用空格分开，回车跳过):"
read UDP_RANGES_INPUT

# Prompt for rule scope
echo "Select rule scope:"
echo "选择端口开放范围:"
echo "1) Apply to WAN interface only"
echo "   仅对WAN口生效"
echo "2) Apply to all incoming traffic"
echo "   对所有入站流量生效"
read -p "(1/2):" RULE_SCOPE

# Create /data/custom_firewall/ports_ipv6.sh
cat > /data/custom_firewall/ports_ipv6.sh << EOF
#!/bin/sh

LOG_FILE="/tmp/firewall_custom.log"

sleep 20

# Define individual ports
TCP_PORTS="$TCP_PORTS_INPUT"
UDP_PORTS="$UDP_PORTS_INPUT"

# Define port ranges  
TCP_RANGES="$TCP_RANGES_INPUT"
UDP_RANGES="$UDP_RANGES_INPUT"

echo "\$(date): Custom IPv6 firewall script started" >> \$LOG_FILE

EOF

# Add corresponding firewall rules based on selection
if [ "$RULE_SCOPE" = "1" ]; then
    cat >> /data/custom_firewall/ports_ipv6.sh << 'EOF'
# Clean up and add individual TCP ports
for port in $TCP_PORTS; do
    ip6tables -D zone_wan_forward -p tcp --dport $port -j ACCEPT 2>/dev/null
    ip6tables -I zone_wan_forward 1 -p tcp --dport $port -j ACCEPT
done

# Clean up and add individual UDP ports
for port in $UDP_PORTS; do
    ip6tables -D zone_wan_forward -p udp --dport $port -j ACCEPT 2>/dev/null
    ip6tables -I zone_wan_forward 1 -p udp --dport $port -j ACCEPT
done

# Clean up and add TCP port ranges
for range in $TCP_RANGES; do
    ip6tables -D zone_wan_forward -p tcp --dport $range -j ACCEPT 2>/dev/null
    ip6tables -I zone_wan_forward 1 -p tcp --dport $range -j ACCEPT
done

# Clean up and add UDP port ranges
for range in $UDP_RANGES; do
    ip6tables -D zone_wan_forward -p udp --dport $range -j ACCEPT 2>/dev/null
    ip6tables -I zone_wan_forward 1 -p udp --dport $range -j ACCEPT
done
EOF
else
    cat >> /data/custom_firewall/ports_ipv6.sh << 'EOF'
# Clean up and add individual TCP ports
for port in $TCP_PORTS; do
    ip6tables -D forwarding_rule -p tcp --dport $port -j ACCEPT 2>/dev/null
    ip6tables -I forwarding_rule -p tcp --dport $port -j ACCEPT
done

# Clean up and add individual UDP ports
for port in $UDP_PORTS; do
    ip6tables -D forwarding_rule -p udp --dport $port -j ACCEPT 2>/dev/null
    ip6tables -I forwarding_rule -p udp --dport $port -j ACCEPT
done

# Clean up and add TCP port ranges
for range in $TCP_RANGES; do
    ip6tables -D forwarding_rule -p tcp --dport $range -j ACCEPT 2>/dev/null
    ip6tables -I forwarding_rule -p tcp --dport $range -j ACCEPT
done

# Clean up and add UDP port ranges
for range in $UDP_RANGES; do
    ip6tables -D forwarding_rule -p udp --dport $range -j ACCEPT 2>/dev/null
    ip6tables -I forwarding_rule -p udp --dport $range -j ACCEPT
done
EOF
fi

# Complete the script
cat >> /data/custom_firewall/ports_ipv6.sh << 'EOF'
echo "$(date): Custom IPv6 firewall configuration completed." >> $LOG_FILE
echo "TCP ports: $TCP_PORTS $TCP_RANGES opened." >> $LOG_FILE
echo "UDP ports: $UDP_PORTS $UDP_RANGES opened." >> $LOG_FILE

EOF

# Give execute permission to the script
chmod +x /data/custom_firewall/ports_ipv6.sh

echo "Custom firewall script created successfully."
echo "定制防火墙脚本已建立."

# Execute the script
# /data/custom_firewall/ports_ipv6.sh

# echo "Custom firewall script executed successfully."
echo "定制防火墙脚本已执行."


# Add to firewall configuration
uci set firewall.ports_ipv6=include
uci set firewall.ports_ipv6.type='script'
uci set firewall.ports_ipv6.path="/data/custom_firewall/ports_ipv6.sh"
uci set firewall.ports_ipv6.enabled='1'
uci set firewall.ports_ipv6.reload='1'

# Commit configuration
uci commit firewall

echo "Custom firewall enabled and configuration committed."
echo "定制防火墙已生效并固化，重启有效"